Rule:--Sid:2067--Summary:This event is generated when an attempt is made to exploit a known vulnerability in a Lotus Domino Server.--Impact:Information disclosure--Detailed Information:Certain versions of Lotus Domino web servers do not correctly handle requests for script files not specific to Lotus Domino.By using a dot in the filename an attacker may view the source of the script and be presented with sensitive information embedded in the script.--Affected Systems:Lotus Domino Server 5.0 and 6.0--Attack Scenarios:The attacker merely needs to make an HTTP request for the script and add a dot to the filename. This can be done using a browser.--Ease of Attack:Simple--False Positives:The HotSaNIC (hotsanic.sourceforge.net) System and Network Info Centre can graph the occurence of worm attacks on a server against time. The HotSaNIC system displays 'WEB-MISC Lotus Notes .exe script source download attempt' type attacks in an image file called thumb-root.exe.gif. Each time this image is accessed it generates an event.--False Negatives:None Known--Corrective Action:Apply the appropriate vendor fixesUpgrade to the latest non-affected version of the software--Contributors:Sourcefire Vulnerability Research TeamBrian Caswell <bmc@sourcefire.com>Nigel Houghton <nigel.houghton@sourcefire.com>False positive information contributed by Chris McMahon <chris@mcmahon.co.uk>--Additional References:--